lazarusholic

Everyday is lazarus.dayβ

ContagiousInterview

2024-10-09, PaloaltoNetworks
Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware

Also known as

 
Name Named by AKA First seen Last seen
ContagiousInterview PaloaltoNetworks FamousChollima 2024-10-09 2026-05-31
ElusiveComet SecurityAlliance FamousChollima 2025-03-24 2025-04-17
FamousChollima CrowdStrike - 2024-08-07 2026-05-31
G1052 MITRE ContagiousInterview 2025-10-19 2025-10-19
GwisinGang DtexSystems FamousChollima 2025-05-14 2025-05-14
HexagonalRodent Expel FamousChollima 2026-04-23 2026-04-30
JasperSleet Microsoft FamousChollima 2025-06-30 2026-04-21
NickelTapestry SecureWorks FamousChollima 2024-10-16 2025-05-08
PolinRider OSM ContagiousInterview 2026-03-08 2026-04-12
PurpleBravo RecordedFuture FamousChollima 2025-02-13 2026-01-21
TenaciousPungsan Datadog FamousChollima 2024-10-24 2024-10-24
UNC5267 Mandiant FamousChollima 2024-09-23 2026-03-09
UNC5342 Mandiant FamousChollima 2025-04-24 2025-10-16
VoidDokkaebi TrendMicro FamousChollima 2025-04-23 2026-05-22
WaterPlum NTTSecurity FamousChollima 2025-05-08 2026-03-17

Reports

2026-05-31
Socket
Famous Chollima Targets PHP Developers Through Compromised Packagist Package
#ContagiousInterview #FamousChollima
2026-05-25
Denv
I was likely targeted by DPRK in a sophisticated developer malware campaign
#ContagiousInterview #VSCode
2026-05-18
meowmfer
Deep Dive into Active Github Network Running Contagious Interview
#ContagiousInterview #BeaverTail #OmniStealer
2026-05-05
OSM
Lazarus Group Uses Git Hooks To Hide Malware
#ContagiousInterview #Lazarus #TasksJacker
2026-04-30
Domaintools
DPRK Contagious Interview: Developer Workflow Compromise
#ContagiousInterview #Lazarus
2026-04-23
Turshija
I got completely owned by the most sophisticated hack I've ever encountered
#ContagiousInterview
2026-04-07
Socket
North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads
#ContagiousInterview
2026-04-02
SafeDep
Malicious npm Package express-session-js Drops Full RAT Payload
#ContagiousInterview #NPM
2026-04-01
BreakGlassIntelligence
Two IOCs In, Five C2 Servers Out: Mapping DPRK's Contagious Interview Campaign From InvisibleFerret to a Kimsuky Crossover
#ClickFix #ContagiousInterview #InvisibleFerret #Kimsuky
2026-03-23
Sophos
NICKEL ALLEY strategy: Fake it ‘til you make it
#NickelAlley #ClickFix #ContagiousInterview #PylangGhost
2026-03-17
NTTSecurity
StoatWaffle, malware used by WaterPlum
#ContagiousInterview #StoatWaffle #VSCode #WaterPlum
2026-03-17
NTTSecurity
WaterPlumが使用するマルウェアStoatWaffleについて
#ContagiousInterview #StoatWaffle #VSCode #WaterPlum
2026-03-11
Microsoft
Contagious Interview: Malware delivered through fake developer job interviews
#ContagiousInterview #InvisibleFerret #OtterCookie #VSCode
2026-03-09
SerapHim
Contagious Interview Campaign: Independent Analysis of the StegaBin Wave
#ContagiousInterview #FamousChollima #StegaBin
2026-03-09
AbstractSecurity
Contagious Interview: Evolution of VS Code and Cursor Tasks Infection Chains Part 2
#ContagiousInterview #VSCode #GolangGhost #PylangGhost
2026-03-08
OSM
PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos
#BeaverTail #ContagiousInterview #NPM #PolinRider #VSCode #GitHub
2026-03-05
Allsecure
North Korea Tried to Hack Our CEO Through a Fake Job Interview on LinkedIn
#BeaverTail #ContagiousInterview #Lazarus #VSCode
2026-02-27
Socket
StegaBin: 26 Malicious npm Packages Use Pastebin Steganograp...
#ContagiousInterview #FamousChollima #NPM #Steganography #StegaBin
2026-02-26
ENKI
Contagious Interview Campaign Abusing VSCode Distributed on Github
#ContagiousInterview #VSCode
2026-02-26
ENKI
Github를 통해 유포된 VSCode 악용 Contagious Interview 캠페인
#ContagiousInterview #VSCode
2026-02-25
AbstractSecurity
Contagious Interview: Evolution of VS Code and Cursor Tasks Infection Chains - Part 1
#ContagiousInterview #VSCode
2026-02-20
SecurityConversations
GitLab doxxes North Korea .gov hackers; fresh Ivanti zero-days; AI addiction and human purpose
#ContagiousInterview #ITWorker #Podcast
2026-02-19
Gitlab
GitLab Threat Intelligence Team reveals North Korean tradecraft
#ContagiousInterview #ITWorker
2026-02-15
unpacker
Beyond the Backdoor: How Contagious Interview Is Surgically Tampering with MetaMask Wallets
#BeaverTail #ContagiousInterview #InvisibleFerret #NPM
2026-02-12
BoringSecurity
Famous Chollima and Dragon Sickness
#ContagiousInterview #FamousChollima #VSCode
2026-02-04
PaloaltoNetworks
CONTAGIOUS INTERVIEW CAMPAIGN ACTIVITY
#ContagiousInterview
2026-02-03
RedAsgard
Hunting Lazarus Part IV: Real Blood on the Wire
#ContagiousInterview #Lazarus
2026-01-28
OSM
New DPRK Contagious Interview Campaign: “Fake Font” Uses Malicious VSCode Fonts
#ContagiousInterview #FakeFont #VSCode
2026-01-26
OSM
Small Open-Source Maintainers Targeted by VS Code Tasks Malware
#ContagiousInterview #VSCode
2026-01-21
RecordedFuture
PurpleBravo’s Targeting of the IT Software Supply Chain
#BeaverTail #ClickFix #ContagiousInterview #GolangGhost #PurpleBravo #PylangGhost
2026-01-20
AbstractSecurity
Contagious Interview: Tracking the VS Code Tasks Infection Vector
#ContagiousInterview #VSCode
2026-01-20
OSM
Contagious Interview gets an upgrade for 2026
#ContagiousInterview #Lazarus
2026-01-20
Jamf
Threat Actors Expand Abuse of Microsoft Visual Studio Code
#ContagiousInterview #VSCode
2026-01-14
OZ
How to Get Scammed (by DPRK Hackers)
#ContagiousInterview #DevPopper
2026-01-13
SecurityAlliance
VS Code Tasks Abuse by Contagious Interview (DPRK)
#ContagiousInterview
2026-01-12
RedAsgard
Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure
#ContagiousInterview #Lazarus
2025-12-23
OSM
New DPRK Malware Uses Microsoft VSCode Dictionary Files
#ContagiousInterview #VSCode
2025-12-10
Flashpoint
Beyond the Malware: Inside the Digital Empire of a North Korean Threat Actor
#ContagiousInterview
2025-11-29
OSM
Latest Contagious Interview malware campaign abuses Microsoft VSCode Tasks
#ContagiousInterview #Lazarus #VSCode
2025-11-26
Socket
Inside the GitHub Infrastructure Powering North Korea’s Contagious Interview npm Attacks
#ContagiousInterview #NPM #OtterCookie
2025-11-25
Jamf
FlexibleFerret: macOS Malware Deploys in Fake Job Scams
#FlexibleFerret #ContagiousInterview
2025-11-23
L0Psec
DPRK Contagious Interview Lure - Go Backdoor & Swift App
#ContagiousInterview #Youtube
2025-11-23
L0Psec
More active DPRK macOS malware "Contagious Interview"
#ContagiousInterview
2025-11-20
Validin
Inside DPRK's Fake Job Platform Targeting U.S. AI Talent
#ClickFix #ContagiousInterview
2025-11-13
NVISO
Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery
#ContagiousInterview #InvisibleFerret
2025-10-21
Bitdefender
Fake Jobs, Real Malware. Uncovering How Cybercriminals are Exploiting the Employment Market
#ContagiousInterview #Lazarus #Youtube
2025-10-21
KL4R10N
Beyond eval(): DPRK’s New Malware Strategy Hidden in Job Assignments
#ContagiousInterview #NPM
2025-10-19
MITRE
Contagious Interview
#ContagiousInterview #G1052
2025-10-15
NTTSecurity
WaterPlumが使用するマルウェアOtterCandyについて
#ContagiousInterview #OtterCandy #WaterPlum
2025-10-15
NTTSecurity
OtterCandy, malware used by WaterPlum
#ContagiousInterview #OtterCandy #WaterPlum
2025-10-10
Socket
North Korea’s Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads
#ContagiousInterview #NPM
2025-09-10
AnyRun
Lazarus Group Attacks in 2025: Overview for SOC Teams
#ContagiousInterview #ITWorker #InvisibleFerret #Lazarus #OtterCookie #PylangGhost
2025-09-04
SentinelOne
North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms
#ClickFix #ContagiousInterview
2025-08-27
Anthropic
Detecting and countering misuse of AI: August 2025
#ITWorker #ContagiousInterview #FamousChollima
2025-07-26
Bloo
InvisibleFerret Threat Intelligence Report
#ContagiousInterview #InvisibleFerret
2025-07-15
Socket
Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader
#ContagiousInterview #NPM #XORIndex
2025-07-01
Proofpoint
Inside North Korea's Global Cyber Playbook
#ContagiousInterview #ITWorker #Podcast #TA427
2025-06-25
Socket
Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages
#BeaverTail #ContagiousInterview #HexEval #NPM
2025-06-25
dazhengzhang
These North Korean phishers just don't stop
#ContagiousInterview
2025-06-13
Nefture
The 2024 Crypto Crime Report
#ContagiousInterview #DMM #Lazarus #RadiantCapital #Whitepaper
2025-05-13
Igloo
북한 위협 행위자 Contagious Interview 캠페인 분석(2보)
#BeaverTail #ContagiousInterview
2025-05-08
NTTSecurity
WaterPlumが使用するマルウェアOtterCookieの機能追加
#OtterCookie #WaterPlum #ContagiousInterview
2025-05-08
NTTSecurity
Additional Features of OtterCookie Malware Used by WaterPlum
#OtterCookie #WaterPlum #ContagiousInterview
2025-04-25
TeamCymru
Now that the cat is out of the bag regarding the use of front companies like BlockNovas LLC
#ContagiousInterview
2025-04-25
HISolutions
Rolling in the Deep(Web): Lazarus Tsunami
#ContagiousInterview #Tsunami
2025-04-24
Silentpush
Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies to Deliver a Trio of Malware
#BeaverTail #ContagiousInterview #InvisibleFerret #OtterCookie #FamousChollima #ClickFix
2025-04-11
Bitso
Interview with the Chollima
#ContagiousInterview #OtterCookie #FamousChollima
2025-04-04
Socket
Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads
#BeaverTail #ContagiousInterview #Lazarus #NPM
2025-03-31
SEKOIA
From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic
#ClickFix #ContagiousInterview #GolangGhost #Lazarus #FrostyFerret
2025-03-24
BirminghamCyber
Cómo domar un Chollima
#ChaoticCapybara #VelvetChollima #macOS #ContagiousInterview
2025-03-15
Slowmist
Analysis of LinkedIn Recruitment Phishing
#ContagiousInterview
2025-03-14
Bruno
I just got a scam attempt by a Linkedin "recruiter"
#ContagiousInterview
2025-03-12
dazhengzhang
Another day another North Korean scammer
#ContagiousInterview
2025-03-10
ronxjansen
Npm Run Hack:Me - A Supply Chain Attack Journey
#ContagiousInterview
2025-02-28
Silentpush
Astrill VPN: Silent Push Publicly Releases New IPs on VPN Service Heavily Used by North Korean Threat Actors
#ContagiousInterview #FamousChollima
2025-02-26
PaloaltoNetworks
RustDoor and Koi Stealer for macOS Used by North Korea-Linked Threat Actor to Target the Cryptocurrency Sector
#ContagiousInterview #Koi #RustDoor #macOS #AlluringPisces
2025-02-19
Kandji
DPRK DriverEasy & ChromeUpdate Deep Dive
#ContagiousInterview #DriverEasy
2025-02-13
Moonlock
Cybercrooks Are Using Fake Job Listings to Steal Crypto
#ContagiousInterview
2025-02-07
RayssaCardoso
Infostealer malware linked to Lazarus Group campaigns
#ClickFix #ContagiousInterview #Lazarus
2025-02-06
HivePro
“Contagious Interview” Targets macOS with FlexibleFerret Malware
#ContagiousInterview #FlexibleFerret
2025-02-03
Igloo
북한 위협 행위자 Contagious Interview 캠페인 분석
#BeaverTail #ContagiousInterview #OtterCookie
2025-02-03
SentinelOne
macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed
#ContagiousInterview #FlexibleFerret #macOS #FrostyFerret
2025-01-20
ENKI
Lazarus의 Contagious Interview 캠페인 변종 분석
#ContagiousInterview #Lazarus
2025-01-16
Validin
Lazarus APT: Techniques for Hunting Contagious Interview
#ContagiousInterview #Lazarus #ClickFix
2025-01-09
Zeroshadow
DPRK's Willo Impersonation Campaign
#ContagiousInterview
2025-01-05
dmpdump
North Korea-nexus Golang Backdoor/Stealer from Contagious Interview campaign
#ContagiousInterview #GolangGhost
2024-12-28
Tay
Heads up all—some dudes have a slick, new way of dropping some nasty malware
#ContagiousInterview #Lazarus
2024-12-27
Rewterz
Developers Targeted by New ‘OtterCookie’ Malware with Fake Job Offers – Active IOCs
#ContagiousInterview #OtterCookie
2024-12-26
NTTSecurity
OtterCookie, new malware used in Contagious Interview campaign
#ContagiousInterview #OtterCookie
2024-12-26
NTTSecurity
Contagious Interviewが使用する新たなマルウェアOtterCookieについて
#ContagiousInterview #OtterCookie
2024-11-04
Zscaler
From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West
#BeaverTail #ContagiousInterview #InvisibleFerret #Wagemole
2024-11-01
Ketman
Malicious Github Accounts with gh-fake-analyzer
#ContagiousInterview #Lazarus
2024-10-29
Macnica
北からのジョブオファー: ソフトウェア開発者を狙うContagious Interview
#FamousChollima #InvisibleFerret #ContagiousInterview #BeaverTail
2024-10-24
Datadog
Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview
#BeaverTail #ContagiousInterview #TenaciousPungsan
2024-10-09
PaloaltoNetworks
Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware
#BeaverTail #ContagiousInterview #InvisibleFerret
2024-09-04
Group-IB
APT Lazarus: Eager Crypto Beavers, Video calls and Games
#BeaverTail #CivetQ #ContagiousInterview #InvisibleFerret #Lazarus #MiroTalk #FCCCall
2024-08-29
Phylum
North Korea Still Attacking Developers via npm
#ContagiousInterview #MoonstoneSleet #NPM
2024-08-23
Coinmonks
Suspicious activity in GitHub associated with Lazarus Group
#ContagiousInterview #Lazarus
2024-07-21
Coinmonks
Investigating the campaigns of Lazarus Group targeting developers and companies
#ContagiousInterview #Lazarus
2024-05-13
Dimitribest
Lazarus Group Targets Blockchain Developers with Social Engineering and Visual Deception Techniques in Code
#ContagiousInterview
2024-05-10
Qianxin
针对区块链从业者的招聘陷阱：疑似Lazarus（APT-Q-1）窃密行动分析
#APT-Q-1 #ContagiousInterview
2023-11-21
PaloaltoNetworks
Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors
#InvisibleFerret #ContagiousInterview #Wagemole #BeaverTail #NPM